APPENDIX_G_-_HIPAA_Business_Associate.pdf

APPENDIX G - COUNTY OF SACRAMENTO

HIPAA BUSINESS ASSOCIATE EXHIBIT TO CONTRACT

Whereas, COUNTY, pursuant to the terms of the Agreement, wishes to disclose to CONTRACTOR and CONTRACTOR wishes to disclose to COUNTY, certain information, some of which may constitute Protected Health Information (PHI) including any in an electronic format (Electronic Protected Health Information or EPHI);

Whereas, in the course of the performance of the Agreement, CONTRACTOR will be provided with access to PHI;

Whereas, COUNTY and CONTRACTOR desire to protect the privacy and provide for the security of PHI disclosed to each other in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Title 45 Code of Federal Regulations (CFR), Title 42 CFR Section 1320d, and regulations promulgated thereunder by the U.S. Department of Health and Human Services (the HIPAA Regulations) and other applicable laws and regulations.

Whereas, it appears that the CONTRACTOR is a Business Associate of COUNTY as that term is defined in the HIPAA regulations; and

Whereas, COUNTY is willing to provide CONTRACTOR and its agents with access to PHI such that CONTRACTOR can perform under the Agreement, under the terms of this Exhibit;

Whereas, the purpose of this Exhibit is to satisfy certain standards and requirements of HIPAA and the HIPAA Regulations, including, but not limited to, Title 45, Section 164.504(e) of the Code of Federal Regulations (CFR), as the same may be amended from time to time.

NOW, THEREFORE, in consideration of the mutual promises made herein, the parties agree as follows:

I. HIPAA REQUIREMENTS

A. Definitions

1. "Protected Health Information" or "PHI" means any information, whether oral or recorded in any form or medium, including electronic (EPHI) as that term is defined in the Security Rule: 1) that relates to the past, present, or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and 2) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under HIPAA and the HIPAA Regulations, including, but not limited to, 45 CFR Section 164.501;

2. "Individual" shall have the same meaning as the term "individual” in 45 CFR Section 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g);

3. "Privacy Rule" shall mean the “Standards for Privacy of Individually Identifiable Health Information”, 45 CFR Part 160 and Part 164, subparts A and E, as amended from time to time.

4. "Security Rule" shall mean the “Security Standards”, 45 CFR Parts 160, 162, and 164.

B. Permitted Uses and Disclosures: CONTRACTOR may use and/or disclose

PHI received by it pursuant to the Agreement and this Exhibit solely for the purpose of performing its obligations under the Agreement and this Exhibit or as otherwise required by law. CONTRACTOR may disclose PHI to, and permit the use of PHI by, its employees, contractors, agents, or other representatives only to the extent directly related to and necessary for the performance of the Agreement and this Exhibit. CONTRACTOR shall not use or disclose PHI in any manner that would constitute a violation of HIPAA and the HIPAA regulations if so used by COUNTY.

C. Use and Disclosure for Contractor's Purposes and Data Aggregation:

CONTRACTOR may, if necessary, use and disclose PHI for the proper management and administration of CONTRACTOR's business or to carry out CONTRACTOR's legal responsibilities. CONTRACTOR may also use PHI to provide data aggregation services to COUNTY as permitted by 45 CFR Section 164.504(e)(2)(i)(B).

D. De-Identification: Notwithstanding anything herein to the contrary, CONTRACTOR may store, analyze, access and use components of PHI that have been "de-identified" and that do not contain individually identifiable health information, provided that any such use is consistent with applicable laws and regulations.

E. Appropriate Safeguards: Prior to receipt of PHI in connection with the

Agreement and Exhibit, CONTRACTOR shall implement and maintain appropriate security safeguards to ensure that PHI is not used or disclosed by CONTRACTOR in violation of this Exhibit or applicable laws and regulations. Security measures maintained by CONTRACTOR shall include such appropriate administrative, technical and physical safeguards as are necessary to protect such PHI. Such safeguards shall be designed to protect the confidentiality and integrity of such PHI obtained, accessed or created from or on behalf of COUNTY. Upon request by COUNTY, CONTRACTOR shall provide a written description of such safeguards. CONTRACTOR shall ensure that any sub-contract it maintains in order to meet the terms of this AGREEMENT includes the same requirements for appropriate safeguards as found in this

AGREEMENT.

F. Reporting Unauthorized Uses and Disclosures: As required by 45 CFR

Section 164.308(a)(2), the designated HIPAA Security Officer of CONTRACTOR shall notify COUNTY in writing within five (5) working days of its discovery of any use or disclosure of PHI not permitted by the Agreement or this Exhibit of which CONTRACTOR or its officers, employees or agents become aware. Such notice shall include the name of each individual, with address or other identifiers where known, whose unsecured protected health information (PHI) has been, or is reasonably believed by the CONTRACTOR to have been, accessed, acquired, or disclosed during such unauthorized use or disclosure.

Any unauthorized use or disclosure shall be treated as discovered by the CONTRACTOR on the first day on which such access, acquisition or disclosure is known to the CONTRACTOR, including any person, other than the individual committing the unauthorized use or disclosure, that is an employee, officer or other agent of the CONTRACTOR, or who should reasonably have known such unauthorized activities had occurred.

CONTRACTOR shall promptly identify, respond to and report to COUNTY any suspected or known "security incident" of which it becomes aware.

Such term is defined in the HIPAA Security Rule, 45 CFR Section 164.304:

“the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.” CONTRACTOR’s incident report shall identify the date of the security incident, the scope of the security incident, the CONTRACTOR's response to the security incident and the identification of the party responsible for causing the security incident, if known.

CONTRACTOR agrees that any sub-contractor of the CONTRACTOR that provides services to the CONTRACTOR directly related to this AGREEMENT has the same responsibilities regarding reporting unauthorized uses or disclosures as the CONTRACTOR. CONTRACTOR further agrees that it shall ensure that these responsibilities are defined in any sub-contract it enters into in order to service this AGREEMENT.

G. Mitigating the Effect of Unauthorized Uses and Disclosures:

CONTRACTOR shall take prompt corrective action to mitigate to the greatest extent possible, any harmful effects arising from any improper use and/or disclosure of PHI and shall take such other action pertaining to such unauthorized use or disclosure as may be required by applicable federal and state laws and regulations.

Mitigation shall include CONTRACTOR notification to each individual whose unsecured protected health information (PHI or EPHI) has been, or is reasonably believed by the CONTRACTOR to have been, accessed, acquired, or disclosed during such unauthorized use or disclosure. The standard for such notification shall comply with all notification requirements as specified in 45 CFR Subpart D.

Upon completion of such notification, the designated HIPAA Security Officer of CONTRACTOR shall provide the COUNTY Compliance Officer a report including the following: method(s) of communication used, as specified in 45 CFR Subpart D; date such notification was made; number of individuals notified; and a copy of the content of the notification.

CONTRACTOR agrees that any sub-contractor of the CONTRACTOR that provides services to the CONTRACTOR directly related to this AGREEMENT has the same responsibilities regarding mitigating any unauthorized uses or disclosures as the CONTRACTOR. CONTRACTOR further agrees that it shall ensure that these responsibilities are defined in any sub-contract it enters into in order to service this AGREEMENT.

H. Individual Rights: CONTRACTOR shall comply with the following individual rights requirements as applicable to PHI obtained, used or maintained by CONTRACTOR:

1. Right of Access. CONTRACTOR shall provide access to PHI, at the request of COUNTY and in the time and manner designated by COUNTY, to COUNTY or, as directed, to an individual in order to meet the requirements under 45 CFR Section 164.524.

2. Right of Addendum. CONTRACTOR shall make any Addendum to PHI that COUNTY directs or agrees to pursuant to 45 CFR Section 164.526 at the request of COUNTY or an individual, and in the time and manner designated by COUNTY.

3. Documenting of Disclosures. CONTRACTOR shall document such disclosures of PHI as would be required for COUNTY to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

4. Right to Accounting of Disclosures. CONTRACTOR agrees to provide COUNTY or an individual, in the time and manner designated by COUNTY, such information collected in order to permit COUNTY to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528.

I. County Obligations:

1. COUNTY shall notify CONTRACTOR of any limitation in its notice of privacy practices in accordance with 45 CFR Section 164.520 to the extent that such limitation may affect CONTRACTOR's use or disclosure of PHI.

2. COUNTY shall notify CONTRACTOR of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect CONTRACTOR's use or disclosure of PHI.

3. COUNTY shall notify CONTRACTOR of any restriction to the use or disclosure of PHI that COUNTY has agreed to in accordance with 45 CFR Section 164.522, to the extent that such restriction may affect CONTRACTOR's use or disclosure of PHI.

J. Contractor's Agents: CONTRACTOR shall require that any agent, subcontractor or other representative that is authorized to receive, use or have access to PHI obtained or created under the Agreement or this Exhibit shall agree in writing to adhere to the same restrictions, conditions and requirements regarding the use and/or disclosure of PHI and safeguarding of PHI that apply to CONTRACTOR under this Agreement and Exhibit. CONTRACTOR shall implement and maintain sanctions against any agent, subcontractor or other representative that violates such restrictions, conditions or requirements and shall mitigate the effects of any such violation. Such agreement shall identify COUNTY as a third-part beneficiary with rights of enforcement in the event of any violations by CONTRACTOR's agents, subcontractors or other representatives. Additionally, the agent, subcontractor or other representative shall be required to notify CONTRACTOR of any instances of which it is aware in which the confidentiality of PHI has been breached.

K. Regulatory Compliance: CONTRACTOR shall make its internal practices, books and records relating to the use and disclosure of PHI received from COUNTY, or created or received by CONTRACTOR on behalf of COUNTY, available to any state or federal agency, including the U.S. Department of Health and Human Services, for purposes of determining compliance with the HIPAA Regulations.

L. Inspection of Records: Within ten (10) calendar days of a written request, CONTRACTOR shall make available to COUNTY for inspection during normal business hours at CONTRACTOR's place of business all records, books, agreements, data, systems, policies and procedures relating to the use and/or disclosure of PHI received from, or created or received by CONTRACTOR on behalf of COUNTY, for purposes of enabling COUNTY to determine CONTRACTOR's compliance with the terms of this Exhibit. In the event that protected health information (PHI) has been, or is reasonably believed by the CONTRACTOR to have been, accessed, acquired, or disclosed, pursuant to (G) of this Exhibit, this advance notice by COUNTY may be waived.

M. Audit, Inspection and Enforcement By County: With reasonable notice, COUNTY and its authorized agents or contractors may audit and/or examine CONTRACTOR's facilities, systems, policies and procedures, data and records as may be necessary to determine compliance with the terms of this Exhibit. CONTRACTOR shall promptly correct any violation of this Exhibit found by COUNTY and shall certify in writing that the correction has been made. COUNTY's failure to detect any unsatisfactory practice does not constitute acceptance of the practice or a waiver of COUNTY's enforcement rights under this Agreement and Exhibit.

N. Compliance With Law: CONTRACTOR shall comply with all applicable federal and state laws and regulations, including, if applicable under the terms and requirements of the Agreement and this Exhibit, the HIPAA Standards for Electronic Transactions, 45 CFR Parts 160 and 162.

O. Interpretation: Any ambiguity in this Exhibit shall be resolved in favor of a meaning that permits COUNTY to comply with HIPAA and its implementing regulations.

P. Amendment: The parties agree to amend this Exhibit from time to time as necessary for COUNTY to comply with the requirements of HIPAA and its implementation.

Q. Term and Termination:

1. The terms of this Exhibit shall remain in effect for the duration of all services provided by CONTRACTOR and for so long as CONTRACTOR shall remain in possession of any PHI received from, or created or received by CONTRACTOR on behalf of COUNTY, unless COUNTY has agreed in accordance with this section that it is not feasible to return or destroy all PHI.

2. Upon termination of the Agreement and this Exhibit, CONTRACTOR shall recover any PHI relating to the Agreement and this Exhibit in the possession of its subcontractors, agents or representatives.

CONTRACTOR shall return to COUNTY, or destroy with consent of COUNTY, all such PHI plus all other PHI relating to the Agreement and this Exhibit in its possession and shall retain no copies. If CONTRACTOR believes that it is not feasible to return or destroy the PHI as described above, CONTRACTOR shall so notify COUNTY in writing. The notification shall include: i) a statement that CONTRACTOR has determined that it is not feasible to return or destroy the PHI in its possession, and ii) the specific reasons for such determination. If COUNTY agrees in its sole discretion that CONTRACTOR cannot feasibly return or destroy the PHI, CONTRACTOR shall ensure that any and all protections, requirements and restrictions contained in this Agreement and Exhibit shall be extended to any PHI retained after the termination of the Agreement and the Exhibit, and that any further uses and/or disclosures will be limited to the purposes that make the return or destruction of the PHI infeasible.

R. Insurance: In addition to any insurance requirements in the Agreement, CONTRACTOR shall maintain insurance, in such amounts as the COUNTY Risk Manager may deem necessary, to cover loss of PHI data and claims based upon alleged violations of privacy rights through improper use or disclosure of PHI. All such policies shall meet or exceed any minimum insurance requirements of the Agreement.

Signature Date Printed Name Position Title Company Name